REDHAT-BUG-2506949: Medium severity Gnome libsoup vulnerability
An unsigned integer underflow in soupfilterinputstreamreaduntil() in libsoup/soup-filter-input-stream.c causes a heap buffer over-read when parsing multipart HTTP responses. When includeboundary is FALSE and the internal buffer contains fewer bytes than the boundary string length, the subtraction of two unsigned values wraps to a very large number, causing the boundary scan loop to read beyond the heap allocation. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream. This is related to but distinct from CVE-2026-1761 — Red Hat's downstream fix for that CVE does not resolve this issue.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/532 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PSIRTSUPT-17666 - Compensating control
Apply mitigations by preventing clients from connecting to untrusted/malicious HTTP servers that can send crafted multipart HTTP responses to libsoup clients using SoupMultipartInputStream.